On August 21, 2026, the Ministry of Industry and Information Technology issued notice to call for public comments on draft of a mandatory national standard Technical requirements for vehicle cryptography application (standard project no.: 20243883-Q-339, hereinafter referred to as “the Draft”). The public consultation period will end on October 20, 2026.

In China, cryptography is considered by the policy makers as a core technology and foundational support for network and information security in the era where the emerging technologies fast development, and as a strategic cornerstone for building an intrinsic security defense system for automotive products. In such case, the Draft is stated by the drafting TC, namely SAC/TC114/SC34 (ICV), as an important measure for implementing the relevant laws of China, including but not limited to the Cryptography Law, Cybersecurity Law, and Data Security Law etc., and as a necessary step toward a closed-loop national system for cybersecurity graded protection and cryptography application security management.

With the development of ICV and the relevant technologies, several prominent issues are identified in the automotive sector's current use of cryptography in China, mainly include:

• The selection of cryptographic algorithms and cryptographic modules lacks unified, mandatory technical requirements. Some products use non-standard cryptographic algorithms or non-compliant cryptographic modules, creating security risks.

• In-vehicle cryptography application scenarios are not fully covered, and the depth and breadth of cryptography use vary across key areas such as secure boot, vehicle-cloud communication, and remote control, with no systematic specification.

• Key management and full-lifecycle security assurance for keys remain weak, leaving security blind spots in key generation, storage, distribution, use, and destruction.

Since the standard project’s approval in 2024, it has undergone repeated research and discussion. Beyond addressing the aforementioned issues, its formulation intends to clarify the overall framework, general requirements, and security requirements for automotive cryptography applications, covering the entire process of design, development, and testing and verification for whole vehicles and components. Specifically, the Draft specifies the technical requirements for cryptographic applications in vehicles and the criteria for determining conformity of the same type, and describes the corresponding test methods. It applies to categories M and N vehicles. Relevant components implementing cryptographic functions on the vehicle side may also refer to the Draft for implementation.

For foreign stakeholders, it is worth noting that the Draft is actually connected to several national and sectoral standards, and relevant requirements shall be consistent with these standards too:

• GB 44495—2024 Technical requirements for vehicle cybersecurity

• GB/T 37092—2018 Information security technology—Security requirements for cryptographic modules

• GM/T 0008—2012 Cryptography test criteria for security IC

• GB/T XXXX Technical specifications of cybersecurity for vehicle chip (standard project no.: 20250941-T-339, and is currently under final approval)

• GB/T 32915—2026 Cybersecurity technology—Randomness test methods for binary sequence

In addition, as the Draft involves compliance upgrades for cryptographic modules, adjustments to vehicle cryptography application architecture, development of vehicle cryptographic functions, and preparation of testing by testing institutions, the drafting TC recommends reserving a transition period to give all relevant parties sufficient time to prepare. The proposed implementation date is January 1, 2029. For newly type-approved vehicle models, implementation would begin on the date the Draft takes effect; for vehicle models that have already obtained type approval, implementation would begin in the 25th month after the Draft takes effect.